CognOS Security Posture Overview

CognOS is a platform that enables AI agents to perform work on behalf of organizations and their personnel. This bulletin summarizes its security design and the division of responsibility between Critical Insight and the customer.

Self-hosted by design

CognOS is licensed software that is generally deployed and operated within customer-controlled infrastructure. In the standard deployment model, Critical Insight does not host customer data or operate any component on the customer's behalf. Source code review identified no telemetry or license verification that reports to Critical Insight.

Identity and access

Users authenticate through the customer's own identity provider. Access is governed by roles and permissions administered by the customer.

Governed AI agents

Each agent operates under its own identity with a limited set of permissions. When an agent acts on behalf of a person, its reach is limited to the actions that both the agent and the person are permitted to perform. Only people may approve gated actions. Customers define the policies that permit, deny, or require approval for any tool or model.

Tenant separation and audit

Each request is scoped to a single tenant. Security decisions are recorded in an append-only audit record that may be exported to support customer compliance reviews.

Shared responsibility

Securing a deployment is a shared responsibility. The customer is responsible for operating a production configuration, protecting its network, secrets, and data stores, and configuring agent governance.